How should cross-site request forgery CSRF be designed for production?

For production, use anti-forgery tokens for cookie-authenticated state-changing requests, apply SameSite cookies appropriately, verify origin where useful, avoid state changes through GET, and understand that bearer tokens sent explicitly are a different threat model. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.